Hybrid IAM and global PKI for an international NGO with 3,500+ user accounts

Situation

An international non-governmental organisation manages more than 3,500 user accounts at 20 locations. It needed an identity and access model that works the same way at every location and meets ISO/IEC 27001, the Swiss Federal Act on Data Protection (DSG) and the Swiss Federal Act on Information Security (ISG). Systems at the locations also had to authenticate to each other in a reliable way.

Approach

Over seven months, WCS designed and built the following:

• Hybrid IAM model with Microsoft Entra ID, Active Directory built on Windows Server 2025 and Entra Connect, so that on-premises and cloud identities are managed from one source.
• Public key infrastructure (PKI) that scales worldwide and issues certificates for system-to-system communication and authentication.
• Business role model with segregation of duties (SoD): access follows a person’s function in the organisation, and combinations of rights that must not coincide are excluded.
• Regulatory alignment with ISO/IEC 27001, DSG, ISG and NCSC recommendations.
• Evaluation of Azure Local (formerly Azure Stack HCI) for decentralised data centres.

Result

The organisation has one documented identity model for all 20 locations. Business roles define who receives which access, and segregation of duties is built into the model from the start. The PKI provides the certificates that systems use to authenticate to each other across locations. The Azure Local evaluation gives the organisation a basis for deciding how to run its decentralised data centres.